recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

test(lasuite-docs): update stale OIDC tests for impress v5.4.0 Bearer-auth removal #12

Merged
autonomic-bot merged 1 commits from test/lasuite-docs-stale-test-20260803 into main 2026-08-03 20:47:51 +00:00
Conversation 1 Commits 1 Files Changed 3
+205 -48
autonomic-bot commented 2026-08-03 20:43:32 +00:00
Owner
Copy Link
Copy Source

Stale-test fix: lasuite-docs OIDC tests vs impress v5.4.0 Bearer-auth removal

Stale tests: tests/lasuite-docs/custom/test_oidc_login.py::test_oidc_login_via_keycloak and
tests/lasuite-docs/custom/test_create_doc.py::test_create_doc_and_read_back.

What changed upstream: impress v5.4.0 removed Bearer/JWT authentication on the API —
the backend now only accepts its own session cookie (Django SessionAuthentication) established
through the OIDC authorization-code flow. Both tests authenticated with
Authorization: Bearer <password-grant JWT> and went RED with
401 "Authentication credentials were not provided" on the v5.4.1 upgrade
(drone build #1136 on the paired recipe PR).

The fix — successor auth path, no assertion weakened:

  • New recipe-local helper _oidc_session.py drives the real OIDC authorization-code login
    (app → keycloak login form → callback → session cookie; CSRF headers on unsafe methods).
    Recipe-local per the tests/ghost/custom/_ghost.py precedent — promote to runner/harness
    if a third recipe needs it.
  • test_oidc_login: keeps the unauth-challenge assertion; adds an assertion that a raw
    Bearer JWT is now rejected (401/403 — the v5.4.0 hardening as the new correct behavior);
    then asserts the session-authenticated /api/v1.0/users/me/ returns the provisioned user.
  • test_create_doc: identical create + read-back round-trip assertions, now over the
    session-authenticated API.

Paired recipe upgrade PR (the pair goes green together):
recipe-maintainers/lasuite-docs#7 (carry-over from
/upgrade-all 2026-07-24; also flagged 2026-07-31).

Lint: ruff check + ruff format --check clean on the changed files with the repo dev-shell
ruff (0.15.14). Note: test_oidc_with_keycloak.py has pre-existing format drift on main
(untouched here).

Opened for visibility/historical record; merged directly once the paired verification is green
(the /cc-ci-tests-update invocation is the authorization).

## Stale-test fix: lasuite-docs OIDC tests vs impress v5.4.0 Bearer-auth removal **Stale tests:** `tests/lasuite-docs/custom/test_oidc_login.py::test_oidc_login_via_keycloak` and `tests/lasuite-docs/custom/test_create_doc.py::test_create_doc_and_read_back`. **What changed upstream:** impress **v5.4.0 removed Bearer/JWT authentication on the API** — the backend now only accepts its own session cookie (Django `SessionAuthentication`) established through the OIDC authorization-code flow. Both tests authenticated with `Authorization: Bearer <password-grant JWT>` and went RED with `401 "Authentication credentials were not provided"` on the v5.4.1 upgrade (drone build #1136 on the paired recipe PR). **The fix — successor auth path, no assertion weakened:** - New recipe-local helper `_oidc_session.py` drives the real OIDC authorization-code login (app → keycloak login form → callback → session cookie; CSRF headers on unsafe methods). Recipe-local per the `tests/ghost/custom/_ghost.py` precedent — promote to `runner/harness` if a third recipe needs it. - `test_oidc_login`: keeps the unauth-challenge assertion; **adds** an assertion that a raw Bearer JWT is now **rejected** (401/403 — the v5.4.0 hardening as the new correct behavior); then asserts the session-authenticated `/api/v1.0/users/me/` returns the provisioned user. - `test_create_doc`: identical create + read-back round-trip assertions, now over the session-authenticated API. **Paired recipe upgrade PR (the pair goes green together):** https://git.autonomic.zone/recipe-maintainers/lasuite-docs/pulls/7 (carry-over from /upgrade-all 2026-07-24; also flagged 2026-07-31). **Lint:** `ruff check` + `ruff format --check` clean on the changed files with the repo dev-shell ruff (0.15.14). Note: `test_oidc_with_keycloak.py` has pre-existing format drift on `main` (untouched here). Opened for visibility/historical record; merged directly once the paired verification is green (the `/cc-ci-tests-update` invocation is the authorization).
autonomic-bot added 1 commit 2026-08-03 20:43:33 +00:00
test(lasuite-docs): update stale OIDC tests for impress v5.4.0 Bearer-auth removal
continuous-integration/drone/push Build was killed
Details
a1a6790c9b 
test_oidc_login_via_keycloak and test_create_doc_and_read_back authenticated with
'Authorization: Bearer <password-grant JWT>'; impress v5.4.0 removed Bearer/JWT
auth on the API (SessionAuthentication only), so both went RED with 401 on the
v5.4.1 upgrade.

Updated to the successor auth path: a new recipe-local _oidc_session.py drives the
real OIDC authorization-code flow (app -> keycloak login form -> callback ->
Django session cookie, with CSRF headers on unsafe methods).
- test_oidc_login: still asserts the unauth challenge redirect; NOW also asserts a
  raw Bearer JWT is REJECTED (401/403 - the v5.4.0 hardening, asserted as the new
  correct behavior); then asserts the session-authenticated whoami returns the
  provisioned user. No assertion weakened - the auth proof is stronger than before.
- test_create_doc: same create+read-back round-trip assertions, now over the
  session-authenticated API.

Stale-test fix for recipe PR
recipe-maintainers/lasuite-docs#7
(carry-over from /upgrade-all 2026-07-24).
autonomic-bot requested review from trav 2026-08-03 20:43:33 +00:00
autonomic-bot requested review from notplants 2026-08-03 20:43:33 +00:00
autonomic-bot commented 2026-08-03 20:47:50 +00:00
Author
Owner
Copy Link
Copy Source

Verified GREEN — cold full-suite ×1 against the paired recipe PR head (upgrade-505e53c @ f772297f), with this branch's tests applied on cc-ci:
install/upgrade/backup/restore/custom all pass (log: verify-lasuite-docs-20260803T204348Z.1.log).
The OIDC authorization-code session login works against the live v5.4.1 deploy, and the raw-Bearer rejection assertion confirms the v5.4.0 hardening.

Merging directly per policy: PR opened for visibility/historical record; the /cc-ci-tests-update invocation is the authorization.

**Verified GREEN** — cold full-suite ×1 against the paired recipe PR head (`upgrade-505e53c` @ f772297f), with this branch's tests applied on cc-ci: install/upgrade/backup/restore/custom all pass (log: `verify-lasuite-docs-20260803T204348Z.1.log`). The OIDC authorization-code session login works against the live v5.4.1 deploy, and the raw-Bearer rejection assertion confirms the v5.4.0 hardening. Merging directly per policy: PR opened for visibility/historical record; the /cc-ci-tests-update invocation is the authorization.
autonomic-bot merged commit 304b1610b5 into main 2026-08-03 20:47:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#12